{"id":254452,"date":"2026-05-22T09:14:00","date_gmt":"2026-05-22T13:14:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/22\/drupal-critical-sql-injection-flaw-now-targeted-in-attacks\/"},"modified":"2026-05-24T21:10:11","modified_gmt":"2026-05-25T01:10:11","slug":"drupal-critical-sql-injection-flaw-now-targeted-in-attacks","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/22\/drupal-critical-sql-injection-flaw-now-targeted-in-attacks\/","title":{"rendered":"Drupal: Critical SQL injection flaw now targeted in attacks"},"content":{"rendered":"

Drupal: Critical SQL injection flaw now targeted in attacks<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/drupal-critical-sql-injection-flaw-now-targeted-in-attacks\/<\/a><\/p>\n

Publish Date: 2026-05-22 09:14:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

Drupal is warning that hackers are attempting to exploit a “highly critical” SQL injection vulnerability announced earlier this week.<\/p>\n

The content management system (CMS) project published a PSA on May 18, urging administrators to reserve time for core updates that addressed an issue that threat actors might start exploiting “within hours or days.”<\/p>\n

The flaw is now tracked as CVE-2026-9082 and was discovered by Google\/Mandiant researcher Michael Maturi. It affects Drupal\u2019s database abstraction API. It allows specially crafted requests to trigger arbitrary SQL injection on sites using PostgreSQL.<\/p>\n

SQL injection is a flaw in which attackers inject malicious SQL commands into database queries via user input fields or dialogs on websites, resulting in unauthorized access, modification, or deletion of database data.<\/p>\n

The flaw is exploitable without authentication and could result in remote code execution, privilege escalation, and information disclosure.<\/p>\n

In an update to the advisory on May 22, Drupal confirmed that exploitation attempts have been detected.<\/p>\n

\u201cThe risk score has been updated to reflect that exploit attempts are now being detected in the wild,\u201d reads the updated advisory.<\/p>\n

Drupal rated the vulnerability as \u201chighly critical,\u201d assigning it an internal score of 23 out of 25. However, NIST has rated it as \u201cmedium severity\u201d based on a CVSS v3 score of 6.5.<\/p>\n

Impact and recommendations<\/h3>\n

CVE-2026-9082 impacts a broad range of Drupal versions, including:<\/p>\n